Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - Fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - Regression caused by the DoS fixes above (bsc#993299)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Solaris system is missing necessary patches to address security updates :

  - Buffer overflow in the gopherToHTML function in     gopher.cc in the Gopher reply parser in Squid 3.0 before     3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11     allows remote Gopher servers to cause a denial of     service (memory corruption and daemon restart) or     possibly have unspecified other impact via a long line     in a response. NOTE: This issue exists because of a     CVE-2005-0094 regression. (CVE-2011-3205)

This update of squid3 fixes a buffer overflow vulnerability in the Gopher reply parser code (CVE-2011-3205).

From Red Hat Security Advisory 2011:1293 :

An updated squid package that fixes one security issue is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

A buffer overflow flaw was found in the way Squid parsed replies from remote Gopher servers. A remote user allowed to send Gopher requests to a Squid proxy could possibly use this flaw to cause the squid child process to crash or execute arbitrary code with the privileges of the squid user, by making Squid perform a request to an attacker-controlled Gopher server. (CVE-2011-3205)

Users of squid should upgrade to this updated package, which contains a backported patch to correct this issue. After installing this update, the squid service will be restarted automatically.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

A buffer overflow flaw was found in the way Squid parsed replies from remote Gopher servers. A remote user allowed to send Gopher requests to a Squid proxy could possibly use this flaw to cause the squid child process to crash or execute arbitrary code with the privileges of the squid user, by making Squid perform a request to an attacker-controlled Gopher server.

Users of squid should upgrade to this updated package, which contains a backported patch to correct this issue. After installing this update, the squid service will be restarted automatically.

This update of squid3 fixes a buffer overflow vulnerability in the Gopher reply parser code. (CVE-2011-3205)

The remote host is affected by the vulnerability described in GLSA-201110-24 (Squid: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Squid. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote unauthenticated attackers may be able to execute arbitrary code       with the privileges of the Squid process or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

A vulnerability has been discovered and corrected in squid :

Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE:
This issue exists because of a CVE-2005-0094 regression (CVE-2011-3205).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

According to its banner, the version of Squid running on the remote host is 3.x prior to 3.0.STABLE26 / 3.1.15 / 3.2.0.11. It reportedly contains a buffer overflow when parsing responses from Gopher servers that results in memory corruption and usually causes the Squid server itself to crash.

Note that Nessus has relied only on the version in the proxy server's banner, which is not updated by either of the patches the project has released to address the issue. If one of those has been applied properly and the service is restarted, consider this to be a false positive.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2011:1293 advisory.

  - squid: buffer overflow flaw in Squid's Gopher reply parser (SQUID-2011:3) (CVE-2011-3205)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Ben Hawkes discovered that Squid 3, a full featured Web Proxy cache (HTTP proxy), is vulnerable to a buffer overflow when processing Gopher server replies. An attacker can exploit this flaw by connecting to a Gopher server that returns lines longer than 4096 bytes. This may result in denial of service conditions (daemon crash) or the possibly the execution of arbitrary code with rights of the squid daemon.

Upstream 3.1.15 release fixing a buffer overflow issue in gopher:// processing (SQUID-2011:3)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
93294	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:2089-1)	Nessus	SuSE Local Security Checks	high
93271	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:1996-1)	Nessus	SuSE Local Security Checks	high
80772	Oracle Solaris Third-Party Patch Update : squid (cve_2011_3205_buffer_overflow)	Nessus	Solaris Local Security Checks	medium
76030	openSUSE Security Update : squid3 (openSUSE-SU-2011:1018-1)	Nessus	SuSE Local Security Checks	medium
75747	openSUSE Security Update : squid3 (openSUSE-SU-2011:1018-1)	Nessus	SuSE Local Security Checks	medium
68351	Oracle Linux 6 : squid (ELSA-2011-1293)	Nessus	Oracle Linux Local Security Checks	medium
61135	Scientific Linux Security Update : squid on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
57134	SuSE 11.1 Security Update : squid3 (SAT Patch Number 5095)	Nessus	SuSE Local Security Checks	medium
56658	GLSA-201110-24 : Squid: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
56526	Mandriva Linux Security Advisory : squid (MDVSA-2011:150)	Nessus	Mandriva Local Security Checks	medium
56215	Squid 3.x < 3.0.STABLE26 / 3.1.15 / 3.2.0.11 Gopher Buffer Overflow	Nessus	Firewalls	medium
56205	RHEL 6 : squid (RHSA-2011:1293)	Nessus	Red Hat Local Security Checks	critical
56143	Debian DSA-2304-1 : squid3 - buffer overflow	Nessus	Debian Local Security Checks	medium
56138	Fedora 14 : squid-3.1.15-1.fc14 (2011-11854)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-3205

critical

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium